Restrictions on Foreign Access to Population Data

Introduction

Population data refers to information collected about individuals or groups within a country, including census records, demographic statistics, health information, genetic data, biometric identifiers, and household or socioeconomic records. Such data may be used for public planning, healthcare, scientific research, and policy development.

Foreign access to population data raises legal concerns because large-scale personal information can reveal sensitive characteristics, enable surveillance, expose individuals to discrimination, or create risks to national security. The issue becomes especially significant when foreign governments, companies, research institutions, or cloud-service providers seek access to identifiable or sensitive population datasets.

Restrictions on foreign access aim to balance international research and economic cooperation with privacy, data security, sovereignty, and public accountability. In India, the legal position depends on the type of data, the purpose of processing, the applicable statutory framework, and whether the data is personal, anonymised, or subject to a specific sectoral restriction.

Legal Framework and Restrictions

India’s approach to foreign access to population data combines privacy protection, statutory confidentiality, and limits on cross-border transfers. The law does not impose one blanket prohibition on all foreign access. Instead, restrictions depend on whether the data is identifiable, confidential, sensitive, or subject to a specific statutory regime.

1. Digital Personal Data Protection Act, 2023

Section 16 permits the Central Government to restrict transfers of personal data to notified countries or territories. It also preserves stricter restrictions under other Indian laws. Therefore, a foreign recipient does not automatically gain lawful access merely because data is digitally transferable.

Indian Kanoon

The DPDP Rules, 2025 were notified on 14 November 2025. Rule 15 addresses transfers outside India and allows the Government to specify requirements for making personal data available to a foreign State, or an entity controlled by or acting for that State.

Official Government Version+1

2. Census Act, 1948

Section 15 provides that census records are not open to inspection and are generally inadmissible as evidence, subject to the statutory exceptions. Census confidentiality is therefore a direct legal protection, not merely a policy preference. The Census Act also restricts unauthorised disclosure by census officers.

Indian Kanoon+1

3. Data minimisation and anonymisation

Population statistics can often be shared for legitimate research after aggregation or anonymisation. However, removing names alone may not be sufficient: location, age, household composition, genetic information, or rare characteristics can make individuals identifiable when datasets are combined. Foreign research access should therefore be assessed for re-identification risks and limited to the necessary data.

Case Laws

1. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1

The Supreme Court recognised privacy as a fundamental right under Article 21 and other constitutional freedoms. It established that an intrusion into privacy must have a legal basis, pursue a legitimate purpose, and be proportionate.

Applied to foreign access, population data cannot be disclosed merely for convenience or commercial benefit. The State must justify access to identifiable information and adopt safeguards against unnecessary disclosure. This case did not specifically decide foreign data transfers.

Indian Kanoon

2. K.S. Puttaswamy v. Union of India (Aadhaar), (2019) 1 SCC 1

The Supreme Court reviewed the Aadhaar system’s collection and use of demographic and biometric information. It upheld important parts of the framework while examining data security, statutory safeguards, and risks of surveillance.

The judgment supports strict control over access to large-scale identity databases. Its relevance to foreign access is by analogy: population information should be protected through clear legal authority, purpose limitation, and safeguards against misuse.

webapi.sci.gov.in

Conclusion

Restrictions on foreign access to population data protect privacy, confidentiality, national interests, and public trust. Indian law does not prohibit every international transfer, but it establishes important safeguards through the DPDP Act, the DPDP Rules, the Census Act, and constitutional privacy principles.

The key distinction is between responsibly shared, anonymised statistical information and identifiable or confidential population records. Foreign access to the latter requires a lawful basis, appropriate safeguards, and compliance with any applicable statutory restrictions. The cases establish privacy and proportionality principles, although there is no direct Supreme Court ruling specifically governing foreign access to population datasets.